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Response to the ICO Consultation on Age-appropriate Design 


We commend and affirm Age Appropriate Design, the proposed code of practice for online services. 
Only a comprehensive adoption of these proposed guidelines will achieve the Government’s stated 
ambition for the United Kingdom (UK) to become the safest place in the world to go online and the 
best place in the world to grow a digital business.’ Protecting children from harm is a principle of 
duty-of-care that must guide, rather than be controlled by, current or emerging technological 
challenges. Children cannot protect themselves and because self-regulation has clearly failed to 
provide adequate protection on their behalf we recommend these draft guidelines as appropriate and 
proportional. 


Under-18s comprise at least 20 per cent of UK internet users.” The Church’s own safeguarding 
policies affirm the belief that all human beings are created in God’s image and that children fully 
deserve to be treated with dignity, care and compassion.’ These draft proposals are commendable for 
recognising the distinctive vulnerabilities and special needs of children and for upholding the United 
Nations Convention on the Rights of the Child.* Children depend on all adults, not just on their own 
parents or primary care-givers, for both their physical safety and for their mental flourishing These 
guidelines materially contribute to realising the common good; 


The principle of the common good, to which every aspect of social life must be related if it is 
to attain its fullest meaning, stems from the dignity, unity and equality of all people. [...] The 
common good does not consist in the simple sum of the particular goods of each subject of a 
social entity. Belonging to everyone and to each person, it is and remains “common”, because 
it is indivisible and because only together is it possible to attain it, increase it and safeguard 
its effectiveness, with regard also to the future.’ 


Yet the Bishop of Chelmsford has noted the consequences of tech firms disregarding this common 
good. 


“An unregulated digital environment is causing moral decay. There is no time to reiterate the 
various harms that are being caused, but they are deep-seated, corrosive and pervasive. Just 
last week I was at a school in Essex talking to seven to eleven year-olds about their use of a 
game called TikTok. All of them were using it. The lower age limit for using it is 13. [...] the 
digital world assumes that all users are equal, and all users are adults, whereas in fact one- 
third of users worldwide are children. Therefore, their health, well-being and development 
require us to ensure that the internet, and the many ways that children access it, are as safe as 


! UK Government (DCMS), Online Harms White Paper, April 2019. 
<https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/793360/Onli 
ne_Harms_White_Paper.pdf> accessed May 16", 2019. 

? Livingstone et al, UNICEF report, One in Three: Internet Governance and Children’s Rights, January 2016, 
accessed May 14, 2019, https://www.unicef-irc.org/publications/pdf/idp_2016_01.pdf. 

3 Church of England Report, All God’s Children, 2010, SS 1.6ff, accessed May 16, 2019, 
https://www.churchofengland.org/sites/default/files/2017-11/protectingallgodschildren.pdf. 

4 UNICEF, United Nations Convention on the Rights of the Child, 1990, accessed May 19, 2019, 
https://www.unicef.org/child-rights-convention. 
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they can be. This has usually meant creating special safe places for children or safety options 
that can be activated.”® 


This code is needed because children cannot protect themselves 


Children are extensive users of digital services and yet cannot protect themselves.’ There are now new 
and emerging risks including potentially exploitative data mining from the burgeoning Internet of 
Things (IoT) children’s market for toys and apps.* There is recent evidence that young people are 
devaluing their own privacy and safety because of their low expectations over treatment by social 
media platforms.’ 


Primary care givers provide protection to children, but few can keep up with the demands of 
technological developments, least of all carers who may, themselves, be vulnerable adults. Parents 
repeatedly call for better protection by the tech sector itself.'° But 75 per cent of young people also 
think social media companies should automatically block offensive and abusive messages.'! 


Children, and younger children particularly, are in favour of social media platforms removing 
offensive or abusive content or direct messages automatically, without the need for a user 
complaint to be made first, and for this to be a default setting. As might be expected, the 
older the children become, the less sure they are that they want to be shielded from offensive 
or abusive content.'” 


This conception of proportional responsibility for the common good is deeply embedded in the 
Christian tradition through its emphasis on practical love for neighbour and theological understanding 
of every person is an interconnected member of an overarching ‘body.’ 


Self-regulation has failed 


Rather than considering the ‘best interests of the child’ as these proposed guidelines correctly 
propose, protecting children has been made harder by the tech industry’s adoption of psychological 
tools to design compulsive and potentially addictive services. The Chief Medical Officer has 
evaluated screen-based activities, finding excess exposure detrimental to children’s sleep, 
concentration, and mood.'* Consequently, we welcome the practicality and the benefits of this Code’s 
revised approach. As the Lord Bishop of St. Albans has observed: 


6 The Lord Bishop of Chelmsford, HL Deb January 17, 2019, vol 795 c408. 

7 Stop It Now UK and Ireland, The Internet and Children... What’s the Problem? accessed May 22, 2019, 
https://www.parentsprotect.co.uk/files/stop_booklets_the_internet_and_children_whats_the_problem01_14.pdf. 
8 Anne Longfield, Who Knows What About Me? A Children’s Commissioner report into the collection and 
sharing of children’s data, November 2018, acessed May 21, 2019, 
https://www.childrenscommissioner.gov.uk/wp-content/uploads/2018/1 1/who-knows-what-about-me.pdf. 

° BCS, The Chartered Institute for IT, Survey: Children’s Views on Internet Safety, 2018, p. 3, accessed May 16, 
2019. https://www.bcs.org/upload/pdf/internet-safety-results.pdf. 

'0 Ofcom, report: Children and Parents Media use and Attitudes 2018, January 2019, accessed May 23, 2019, 
https://www.ofcom.org.uk/__data/assets/pdf_file/0024/134907/Children-and-Parents-Media-Use-and-Attitudes- 
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11 BCS, survey: Young People and Bullying on Social Media Social Survey, 2018, accessed May 22, 2019, 
https://www.bcs.org/upload/pdf/internet-safety-results.pdf. 

12 Thid, p.4. 

13.1 Corinthians 12:12-21; Colossians 3:15. 
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people’s mental health and psychosocial wellbeing: a systematic map of reviews’, February 2019, accessed May 
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“It has been encouraging that the Gambling Commission has taken a stronger line on an 
industry that in the past performed abysmally in its duty of care to its customers. If companies 
such as Facebook, Snapchat or YouTube are to behave, the regulators will need to have 
significant powers and there will need to be real independence. [...] some cynics have been 
arguing that some of these companies simply budget in the fines as part of their ongoing 
business so that they can keep going as they have in the past. [...] Therefore, there is a 
question about not only how we regulate them but how we get them to engage with the wider 
debate about the sort of world we want to create.”!° 


This wider debate about the common good, and any attendant legislation, is essential because self- 
regulation has clearly failed. The tech industry appeals to ‘exceptionalism’ in order to separate its own 
behaviour from that permitted in the offline world while conventional economic models explain how 
the profit motive incentivises a race to the bottom where ‘dark nudges’ exploit vulnerability that 
harms individual users and imposes economic costs on society.! The Lord Bishop of Gloucester has 
highlighted the damaging consequences of digital platforms absolving themselves of responsibility for 
access to content: 


“The content we consume shapes how we see ourselves, other people and the world. It is no 
longer sufficient for social media and online platforms to cling to a simple dichotomy of 
platform versus publisher in order to escape responsibility for the content they promote and 
share. While previous generations’ engagement with media might have been limited to print 
media and television broadcasts regulated by formal standards and watersheds, modern 
consumers, including children, are exposed to huge swathes of unregulated content. Research 
conducted by the UK Safer Internet Centre in 2016 found that more than 80 per cent of the 
teenagers surveyed had seen or heard online hate about a specific group.””"” 


This draft Code is commendable for its principle of parity; reasserting the continuity of duty of care in 
both the online and offline ‘worlds’. But this Code is also needed because Ofcom acknowledge that it 
is not possible simply to port existing legislation to cover the online world.'* This demonstrates the 
importance of establishing a principle-based code that is ethically robust while remaining technology- 
neutral. 


Some clarifications and strengthening of the Code are still needed 


The ‘principle-based’ emphasis in this draft Code is excellent and strongly affirmed. Nonetheless, 
scope for greater clarity remains. 


e Where is the threshold around “likely to be accessed by children’’? 


We agree that children must have their settings moved to ‘high privacy’ by default and we therefore 
require improved clarity over the use of the word ‘likely’ and inclusion of example services. For 
instance, it is not clear what “documented evidence’ will satisfy the proposed test for exclusion. The 
draft guidelines would also benefit from clarifying their scope since both gambling and streaming 
services, even where their terms of service specifically exclude under-18 years olds can, in practice, 


17, 2019, https://www. gov.uk/government/publications/uk-cmo-commentary-on-screen-time-and-social-media- 
map-of-reviews. 

15 The Lord Bishop of St. Albans, HL Deb April 30, 2019, vol 797 c908-9. 

'6 Philip W. S. Newall, ‘Dark Nudges in Gambling’, Addiction Theory and Research, Vol. 27, Issue 2, (2018), 
65-67, accessed May 16, 2019, https://doi.org/10.1080/16066359.2018.1474206. 

17 The Lord Bishop of Gloucester, HL Deb January 11, 2019, vol 788 c376. 

'8 Ofcom report, Addressing Harmful Online Content, Sep. 2018, p4, accessed May 19, 2019, 
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be expected to be ‘likely to be accessed’ by under-18 year olds unless robust exclusion and age- 
verification procedures are put in place. 


e Clearer definition of adverse versus beneficial “nudges” 


While the draft code’s DPIA template includes the question, “Does your service use any nudge 
techniques?” the draft is, again, short on both detail and examples. Dark nudges and ‘sludge’ (the 
practice of making commercially unwelcome features onerous to utilise) are already having tangible 
effects on the well-being of children. ° 


e Age-verification must be robust, but not lead to undue data collection or improper data 
use. 


Limiting content in an age-appropriate way depends upon robust mechanisms for verifying the user’s 
age. Clearly, current solutions are not working and undermine trust in the tech sector.” The case for 
this draft Code’s proportionate and risk-based approach to age-verification is overwhelming. Dilution 
of that principle would risk two consequences. First it would increase the difficulty of identifying the 
‘best interests’ of individuals under 18 years of age accessing digital services. Secondly, dilution 
would diminish the commercial opportunities this provision invites for technological innovation in the 
digital world. Without a robust and rigorous age-verification mechanism, the duty of care principle 
that underpins these guidelines cannot be implemented. 


Age-verification must also respect the child’s privacy, affording them space to develop their own 
sense of personhood and identity. As the Bishop of Gloucester has said: 


“I have had the privilege of meeting young people in primary and secondary schools in 
Gloucestershire, and much of what I have heard from them resonates with the recommendations 
of this report. As the report highlights, children live in a world where being online is interwoven 
with every aspect of their everyday lives, and young people do not want discussion about the 
internet always to begin from an angle of prohibition. It is undoubtedly good that there is a clear 
commitment to keep children and young people safe online. We need child-centred design, a code 
of practice and adequate procedures, but all that must sit within a wider context of human 
flourishing and human relationship.”! 


To that end we also strongly affirm the Code’s principles concerning data minimisation and data 
sharing. 


Difficulty is no excuse 


Far from stifling innovation, the principle of ‘safety by design’ should stimulate Information Society 
Services (ISS) to innovate in lockstep with the needs of children. The precautionary principle 
recommending high privacy as the default unless there is “compelling evidence’ to justify the 
contrary, protects all children. The online world shares the offline world’s ethical duty to differentiate 
between children and adults, and to respect and protect both the vulnerable and marginalised in the 


1 The 5Rights Foundation report, Disrupted Childhood, 2018, accessed May 21, 2019, 
https://Srightsfoundation.com/static/5 Rights-Disrupted-Childhood.pdf. 

2 Anthony Cuthbertson, “Snapchat admits its age verification system does not work”, Independent Newspaper, 
May 19, 2019, accessed May 21, 2019, https://www.independent.co.uk/life-style/gadgets-and- 
tech/news/snapchat-age-verification-not-work-underage-ageid-a882975 | .html. 

21 The Lord Bishop of Gloucester, HL Deb November 7, 2017, vol 785 c1756. 
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digital world. Moreover, the parable of the good Samaritan represents the call to practice ethically 
beneficial actions toward others that transcends both social and political jurisdictions” The tech sector 
needs to accept the demands of responsibility above profitability and to acknowledge its own 
corporate social responsibility to uphold the common good. 


Tailoring access to protect children’s welfare while meeting their developmental needs is not 
technologically beyond the ‘best interests’ benchmark of the draft guidelines and should not be 
allowed to mask or defend poor practice. As the Bishop of Gloucester observes: 


“The challenge for each of us is to ensure our language and our words validate every child as 
a whole person. How are we speaking to their inner being? Their character? This is about our 
encouragement and challenge of children, focusing on the heart of who they are so that they 
can continue to grow and flourish in becoming who God calls them to be.” 


Indeed, as the 5Rights Foundation note: ‘Innovation that doesn’t respect the rights of children is not 
innovation — it’s exploitation.’ 


Conclusion 


We strongly affirm and endorse the principles, and, with due clarification, the specific provisions 
contained in this draft Code. The principles it embeds provide for the kinds of protection that are, 
themselves, essential for the flourishing of children and for the benefit of society. On the positive side, 
as the Bishop of Chelmsford notes: 


“The digital age can be an age of cultural, intellectual and even moral prosperity, but 
enlightened legislation based on sound and child-centred research is needed to lift it from the 
mire and misery it is also creating. This will require great determination from the 
Government, but perhaps the first step is to acknowledge that self-regulation does not work. 
Commercial interest always outflanks care of the child. This must change, and the 
Government must take a lead. It is often said of government that its first responsibility is to 
protect citizens. We should now ask our Government to protect our children.” 


GDPR (Recital 38), recognises: ‘Children merit specific protection with regard to their personal data, 
as they may be less aware of the risks, consequences and safeguards concerned and their rights in 
relation to the processing of personal data.’ The costs of inaction should not be underestimated. The 
Archbishop of Canterbury has observed: 


“If we get this wrong there are immediate harms to today’s children, but there will also be 
longer term harms, not only for them as they mature, but for the wider society that they will 
help to form.””6 


>? Luke 10:25-37. 

23 Rt Revd Rachel Treweek, Bishop of Gloucester, “From the Inside Out in an Upside Down World”, accessed 
May 20, 2019, https://www.gloucester.anglican.org/wp- 
content/uploads/2018/04/cpc018_good_childhood_theology_web.pdf. 

4 5Rights Foundation, “SRights welcomes the launch of the Information Commissioner’s draft Age Appropriate 
Design Code”, accessed May 20, 2019, https://Srightsfoundation.com/uploads/Srightsaadcbriefing. pdf. 

25 The Lord Bishop of Chelmsford, HL Deb November 7, 2019, vol 785 c1747. 

26 The Archbishop of Canterbury, “Reimagining Britain: Faith and the Common Good”, William Temple 
Annual Lecture, May 15, 2019, accessed May 21, 2019, https://www.archbishopofcanterbury.org/speaking-and- 
writing/speeches/archbishop-canterbury-delivers-william-temple-foundation-annual. 


